← Back

Flash Player

flash_player

Vendor: Adobe • 1,084 CVEs

CVEs (1,084)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2009-1864
1Adobe
3Air
Flash PlayerFlex
Apr 23, 2026
Jul 31, 2009
N/A· v4
N/A· v3
9.3 HIGH· v2
Heap-based buffer overflow in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary co...Show more
Heap-based buffer overflow in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.Show less
CVE-2009-1863
1Adobe
3Air
Flash PlayerFlex
Apr 23, 2026
Jul 31, 2009
N/A· v4
N/A· v3
9.3 HIGH· v2
Unspecified vulnerability in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary cod...Show more
Unspecified vulnerability in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors, related to a "privilege escalation vulnerability."Show less
CVE-2009-1862
1Adobe
3Acrobat
Acrobat ReaderFlash Player
Apr 22, 2026
Jul 23, 2009
N/A· v4
7.8 HIGH· v3
9.3 HIGH· v2
Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of se...Show more
Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.Show less
CVE-2009-0522
1Adobe
4Air
Flash PlayerFlash Player For Linux+1 more
Apr 23, 2026
Feb 26, 2009
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 on Windows allows remote attackers to trick a user into visiting an arbitrary URL via an unspecified manipulation of the "mouse pointer display," related...Show more
Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 on Windows allows remote attackers to trick a user into visiting an arbitrary URL via an unspecified manipulation of the "mouse pointer display," related to a "Clickjacking attack."Show less
CVE-2009-0520
1Adobe
4Air
Flash PlayerFlash Player For Linux+1 more
Apr 23, 2026
Feb 26, 2009
N/A· v4
N/A· v3
9.3 HIGH· v2
Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows remote attackers to execute arbitrary code...Show more
Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows remote attackers to execute arbitrary code via a crafted file, related to a "buffer overflow issue."Show less
CVE-2009-0519
1Adobe
4Air
Flash PlayerFlash Player For Linux+1 more
Apr 23, 2026
Feb 26, 2009
N/A· v4
N/A· v3
9.3 HIGH· v2
Unspecified vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a crafted Shockw...Show more
Unspecified vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a crafted Shockwave Flash (aka .swf) file.Show less
CVE-2009-0114
1Adobe
4Air
Flash PlayerFlash Player For Linux+1 more
Apr 23, 2026
Feb 26, 2009
N/A· v4
N/A· v3
5.8 MEDIUM· v2
Unspecified vulnerability in the Settings Manager in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87, and possibly other versions, allows remote attackers to trick a user into visiting an arbitrary URL...Show more
Unspecified vulnerability in the Settings Manager in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87, and possibly other versions, allows remote attackers to trick a user into visiting an arbitrary URL via unknown vectors, related to "a potential Clickjacking issue variant."Show less
CVE-2008-5363
1Adobe
2Air
Flash Player
Apr 23, 2026
Dec 8, 2008
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not validate character elements during retrieval from the dictionary data structure...Show more
The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not validate character elements during retrieval from the dictionary data structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF file.Show less
CVE-2008-5362
1Adobe
2Air
Flash Player
Apr 23, 2026
Dec 8, 2008
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, accepts an untrusted input value for a "constant count,...Show more
The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, accepts an untrusted input value for a "constant count," which allows remote attackers to read sensitive data from process memory via a crafted PDF file.Show less
CVE-2008-5361
1Adobe
2Air
Flash Player
Apr 23, 2026
Dec 8, 2008
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not verify a member element's size when performing (1) DefineConstantPool, (2) Acti...Show more
The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not verify a member element's size when performing (1) DefineConstantPool, (2) ActionJump, (3) ActionPush, (4) ActionTry, and unspecified other actions, which allows remote attackers to read sensitive data from process memory via a crafted PDF file.Show less
CVE-2008-4824
1Adobe
1Flash Player
Apr 23, 2026
Nov 17, 2008
N/A· v4
N/A· v3
9.3 HIGH· v2
Multiple unspecified vulnerabilities in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0 allow remote attackers to execute arbitrary code via unknown vectors related to "input validation errors."
CVE-2008-4823
1Adobe
1Flash Player
Apr 23, 2026
Nov 10, 2008
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to loose interpretation of an ActionScript attribute...Show more
Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to loose interpretation of an ActionScript attribute.Show less
CVE-2008-4822
1Adobe
1Flash Player
Apr 23, 2026
Nov 10, 2008
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Adobe Flash Player 9.0.124.0 and earlier does not properly interpret policy files, which allows remote attackers to bypass a non-root domain policy.
CVE-2008-4821
1Adobe
1Flash Player
Apr 23, 2026
Nov 10, 2008
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Adobe Flash Player 9.0.124.0 and earlier, when a Mozilla browser is used, does not properly interpret jar: URLs, which allows attackers to obtain sensitive information via unknown vectors.
CVE-2008-4820
1Adobe
1Flash Player
Apr 23, 2026
Nov 10, 2008
N/A· v4
N/A· v3
7.1 HIGH· v2
Unspecified vulnerability in the Flash Player ActiveX control in Adobe Flash Player 9.0.124.0 and earlier on Windows allows attackers to obtain sensitive information via unknown vectors.
CVE-2008-4819
1Adobe
1Flash Player
Apr 23, 2026
Nov 10, 2008
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Unspecified vulnerability in Adobe Flash Player 9.0.124.0 and earlier makes it easier for remote attackers to conduct DNS rebinding attacks via unknown vectors.
CVE-2008-4818
1Adobe
1Flash Player
Apr 23, 2026
Nov 10, 2008
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving HTTP response headers.
CVE-2008-4473
1Adobe
1Flash Player
Apr 23, 2026
Oct 17, 2008
N/A· v4
N/A· v3
9.3 HIGH· v2
Multiple heap-based buffer overflows in Adobe Flash CS3 Professional on Windows and Flash MX 2004 allow remote attackers to execute arbitrary code via an SWF file containing long control parameters.
CVE-2008-4401
1Adobe
1Flash Player
Apr 23, 2026
Oct 17, 2008
N/A· v4
N/A· v3
10.0 HIGH· v2
ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download oper...Show more
ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file.Show less
CVE-2008-4546
1Adobe
1Flash Player
Apr 23, 2026
Oct 14, 2008
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows remote web servers to cause a denial of service (NULL pointer dereference and browser crash) by returning a differe...Show more
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows remote web servers to cause a denial of service (NULL pointer dereference and browser crash) by returning a different response when an HTTP request is sent a second time, as demonstrated by two responses that provide SWF files with different SWF version numbers.Show less